Success Factors in Secure Software Development of Cloud Applications in Germany: A Qualitative-explorative Expert Study

Abstract

The use of cloud computing continues to increase in Germany, according to Germany's digital association. However, threats to information security stand in the way of a comprehensive acceptance and penetration of cloud computing. Secure software development is described in the standard ISO/IEC 27001, security control A.14.2 “Security in development and support processes” and in the cloud related code of practice standard ISO/IEC 27017 in chapter 14.2 “Security in development and support processes”. Secure software development has the potential to reduce vulnerabilities and thus increase the security level of applications. When implementing a secure software development process of cloud applications, the question for organizations is which factors have a positive influence on success, where success is defined as an increased security level of cloud applications. This paper contributes to answering the questions of (RQ1) what potential success factors exist in secure software development of cloud applications in Germany and (RQ2) what role does strategic and operational aspects play.